The Sept. 24, 2026 hack of the Bitget exchange, which drained $387.5 million from hot and warm wallets, has yielded new clues. Independent researcher Andrey Sergeenkov found that the hacker’s laundering process generated $761,725 in affiliate fees for intermediary protocols, according to transaction data through Oct. 2, 2026.
The hundreds of thousands of dollars in fees served as a roadmap pointing to other entities outside the hacker’s control.
The RUNE Trail Leading to OKX
Sergeenkov tracked $259,718 flowing to seven THORChain affiliate addresses. All seven addresses have direct financial ties to the initial hacker wallet. The largest address, starting with thor18dv, received a share of $177,499. The second and third addresses followed with $56,514 and $18,080, respectively, with part of the third address’s fees even recorded looping back to the original sender wallet.
Tracing the $177,499 balance from the largest recipient revealed a specific fund routing path. The funds, held in RUNE tokens, were swapped for USDT, moved across two Ethereum wallets, and ultimately deposited entirely into an address labeled ‘OKX Hot Wallet 5’ on Etherscan.
Involvement Status of Affiliate Recipients
Sergeenkov emphasized that being a fee recipient does not prove an entity’s direct involvement in the theft. Application interfaces or scripts could easily insert third-party addresses to collect fees just before the hacker signs a transaction.
A second group of affiliate recipients collected the remaining $206,196 in fees without showing further financial ties to the hacker. An entity named naswap took a $102,344 share in this group, followed by a multi-named THORChain account holder holding $92,438.
Stolen Bitget funds saw heavy traffic on THORChain. A BlockSec report noted that roughly $269 million in hacked funds passed through the protocol across 7,804 transactions through Sept. 29. The perpetrator’s wallet executed 27 swaps there, converting 2,390 ETH into 75.2 BTC worth $6.3 million.
Limits of Cross-Chain Assistance
Bitget previously urged THORChain operators to freeze the addresses holding the stolen funds. THORChain rejected the request.
THORChain stated that its emergency halt mechanisms are designed purely to protect the core network’s operational stability, not to intercept individual user transactions. The incident highlights that code infrastructure providers choose to remain neutral, even when directly facing an exchange attempting to recover stolen assets. Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
